On the 8th December 2015, Microsoft released Security Bulletin MS15-130 [1] to fix a vulnerability in Unicode Scripts Processor component found by Secunia Research [2]. The Common Vulnerabilities and…

By @breenmachine Privilege Escalation on Windows 7,8,10, Server 2008, Server 2012 … and a new network attack How it works Hot Potato (aka: Potato) takes advantage of known issues in Windows t…

Early last year Gareth Heyes unveiled a fascinating new technique for attacking web applications by exploiting path-relative stylesheet imports, and dubbed it ‘Relative Path Overwrite’. This attack tr

Common Windows Privilege Escalation Vectors Imagine this scenario:  You've gotten a Meterpreter session on a machine (HIGH FIVE!), and you opt for running getsystem in an attempt to escalate your privileges... but what that proves unsuccessful?  Should you throw in the towel? Only if you're a quitter... but you're not, are you?  You're a champion!!!  :) In this post I will walk us through common privilege escalation techniques on Windows, demonstrating how to "manually" accomplish each task as well as talk about any related Metasploit modules.  While most techniques are easier to exploit...

How An XSS in (Hipchat Native OSX application) can lead to remote code execution. Two issues exist in Atlassian’s HipChat desktop client that allow an attack...

vBulletin is a commercial forum and blog platform developed by vBulletin Solutions, Inc. It was created over 10 years ago and is written in PHP. It is the world’s most popular forum platform, powering ~78% out of the forums in the top 100K web-sites. Currently there are estimated to be over 40,000 live sites using…

In our previous post , we looked at a bug that allowed malware running on OS X to make calls on a ...

TL;DR

I would like to share IE XSS Filter bypass with escape sequence of HZ-GB-2312 encoding. To use this vector, we need the target page's Cont...

Brute force attacks are one of the oldest and most common types of attacks that we still see on the Internet today. If you have a server online, it's most likely being hit right now.

Hey! The videos from AppSec 2015 are now online, and the Service Workers talk is too. Anyway, this post is about another of the slides in...

tl;dr Apple Safari for OS X was prone to URI spoofing vulnerability  (and more general a user interface spoofing). Apple released security u...

TL;DR

Using Formula Injection to attack users and steal spreadsheet contents:

On August 11, 2015 Microsoft released 14 security fixes, including an SMB Server fix. In this post I'll explain how I triggered the SMB Server bug. Microsoft Security Bulletin MS15-083: Of all the available patches, I focused in this one: Server Message Block Memory Corruption Vulnerability - CVE-2015-2474

What is being disclosed today?

TL;DR

babun - Babun - a Windows shell you will love!

It turned out that the extension corruption issue was reported in a separate report and by the time I reported the combination of the two issues, the fix for the corruption issue was already out in Chrome Beta! Both issues are now fixed in the latest stable version.

От переводчика: Совсем недавно узнал про эту довольно интересную базу данных и как раз наткнулся на свежую статью. На Хабре нет почти ни слова о RethinkDB, в...

Last month, Stefan Esser blogged about a zero-day vulnerability in OS X, without having informed Apple about the problem first. Unfortunately, today has brought the discovery of the first known exploit.

This post revolves around a remote code execution vulnerability that I found in Shopify Before I start I'd inform you that the vulnerability I found was reported to Shopify, as a part of their bug bounty program in early July and has been fixed. This vulnerability was in the subdomain

Intro С большим удовольствием хочу представить новую версию Intercepter-NG 0.9.10, которая, на мой взгляд, в значительной степени расширяет область применения...

Die neuesten Tweets und Antworten von Casey Smith (@subTee). Offline